Jordan Harband
c8a2a81f92
curl only skips reading `.curlrc` when `-q` is its very first argument; anywhere else, the config file has already been read by the time `-q` is seen.a4f89c62added `-q` to every curl call so that a user's `.curlrc` would not affect nvm, but6a3b1dd2(v0.33.2) put `--compressed` in front of it everywhere.bd090ef7(v0.40.0) moved it back to the front in `nvm.sh`'s `nvm_download`, and then6d870d18(v0.40.5) began building those arguments with `set --`, prepending `--compressed` after `-q`, so whenever curl supports compression, `-q` was second again. `nvm_get_latest` and `install.sh`'s `nvm_download` have passed `--compressed` before `-q` since v0.33.2. Pass `-q` first in all three places. Settings in a user's `.curlrc` (such as a proxy, CA bundle, or `write-out`) no longer apply to nvm's own curl calls, as was intended, and as in v0.40.0 through v0.40.4 for `nvm_download`; the corresponding environment variables (eg, `https_proxy`, `CURL_CA_BUNDLE`) still apply. The existing `nvm_get_latest` test pinned the old argument order, so its expectation is updated Discovered by Anthropic's OSS Scanner, as ANT-2026-DESJ2ESZ; the scanner reported it as a vulnerability, but it is not one.
37 lines
870 B
Bash
Executable File
37 lines
870 B
Bash
Executable File
#!/bin/sh
|
|
|
|
OLDPATH="$PATH"
|
|
WORK="$PWD/nvm_download-q-first-work.$$"
|
|
TEST_BIN="$WORK/bin"
|
|
ARGV_LOG="$WORK/argv.log"
|
|
|
|
cleanup() {
|
|
unset -f die cleanup
|
|
rm -rf "$WORK"
|
|
export PATH="$OLDPATH"
|
|
}
|
|
die () { echo "$@" ; cleanup ; exit 1; }
|
|
|
|
NVM_ENV=testing \. ../../install.sh
|
|
|
|
mkdir -p "$TEST_BIN"
|
|
|
|
# fake curl: record each received argument, then succeed
|
|
{
|
|
echo '#!/bin/sh'
|
|
echo ': > "$ARGV_LOG"'
|
|
echo 'for a in "$@"; do printf "%s\n" "$a" >> "$ARGV_LOG"; done'
|
|
echo 'exit 0'
|
|
} > "$TEST_BIN/curl"
|
|
chmod +x "$TEST_BIN/curl"
|
|
|
|
export ARGV_LOG
|
|
export PATH="$TEST_BIN:$OLDPATH"
|
|
|
|
nvm_download -s 'http://example.test/nvm.sh' -o - || die 'nvm_download returned nonzero'
|
|
|
|
# curl only skips reading `.curlrc` when `-q` is its very first argument
|
|
[ "$(head -n 1 "$ARGV_LOG")" = '-q' ] || die "curl did not receive -q as its first argument; got: $(cat "$ARGV_LOG")"
|
|
|
|
cleanup
|